Every NAND formula of size N can be evaluated in time N^{1/2+o(1)} on a quantum computer